Certified Defenses Against Additive Perturbations. To overcome the adversarial vulnerability of deep models, several empirical defenses have been presented, however, they were found to fail against new adaptive attacks [1]}. This forced researchers to provide certified defenses that guarantee stable performance. A number of works have been tackling this problem for small additive perturbations from different perspectives. This includes semi-definite programming [2]}, interval bound propagation [3]}, convex relaxation [4]}, duality perspective [5]}, Satisfiability Modulo Theory [6]}, [7]}, [8]}. Although these methods consider small networks, randomized smoothing [9]}, [10]}, [11]} and its improvements [12]}, [13]} have been proposed as a certified defense for any network that can be applied to large-scale datasets.
